All Detections

Coolclient Msagent Sys Rootkit Driver

avatar
Duo Tech@duotech
updated Aug 14, 2026005

Detects the msagent.sys signed kernel-mode rootkit driver used by the CoolClient backdoor (HoneyMyte/Mustang Panda)

YARA